security policy / reporting security issues

[4390c336]

I want to share some security findings, but the repo has no security contact or a safe way to communicate.

is there safe channel to report ? or should the project enable something like https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability

[gotson]

i cannot manage the repo's settings, @xerial would you want to enable private vulnerability reporting?

[4390c336]

can I email the details to you or any other maintainer ?

[xerial]

Thanks. I'll take a look

[xerial]

And also enabled private reporting https://github.com/xerial/sqlite-jdbc/security/